Jump to content

Invalid IP response connecting to API using IPv6 address

Recommended Posts

I encountered a customer's installation that presented a new one for me.


I updated the customer's system from 5.2.7 to 5.2.10 (incrementally, 5.2.8, 5.2.9...) and the API interface no longer authenticated the API user.


Aside from the upgrade, nothing else has changed.


The error returned by the API interface simply read "Invalid IP" whereas every other time I've encountered this WHMCS' API kindly returns the offending IP address. This time no.


I suspect that input filtering is being done on ALL the variables at the moment of initialization now, and that an IPv6 address containing colons `:` is being wiped from the server array. This would explain no IP address being returned back to the client.


My workaround is fine for now, simply activating and utilizing an API Access Key to bypass the IP restriction, but thought I'd bring it to everyone's attention and possibly added to the bug list.

Share this post

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

  • Similar Content

    • By WHMCS John
      An issue has been identified in the 7.4.2 release - published on 9th January, 2018 - that is causing the GetProducts API command not to return product data in the expected format.
      Data is incorrectly returned as:
      Array ( [result] => success [totalresults] => )  
    • By wellconnit
      Hi All,
      I've written some PHP to extract client files from the WHMCS database because it's not a native API call.
      Just opened the thread to share it with anyone who may want to use it.
      I'm working on another to update the Last Login details also.
      Create the SQL Connection then
      Get the Files List - Pass $userID as the clientID - While loop ensures all records are put into the arrary
      function getfiles($userID)
      $conn = new mysqli('DBAddress', 'DBUser', 'DBPW', 'DBName')
      $result = $conn->query("SELECT * FROM `tblclientsfiles` WHERE userid = $userID");
          $rows = array();
          while($row = $result->fetch_assoc()) {
              $rows[] = $row;
       return $rows;
      $filesData = getfiles($userID);
       for ($counter = 0; $counter < count($rows); $counter++)
                  $split = explode("_", $filesData[$counter]['filename']);
              echo "<tr><td>" . $split['1'] . "</td><td><a href='WHMCSWebsite/attachments" .$filesData[$counter]['filename']. "'>Download</a></td></tr>";
      That should be enough for people to be able to extract the files list and display it through the API.
    • By wellconnit
      Hi All,
      Has anyone successfully worked out a way to generate a forgotten password email from the WHMCS API?
      It's all good to be able to login to the system but if the user has forgotten their password it's pointless getting them to sign into the WHMCS version of the site when you're using the API to make sure they don't hit that site in the first place?
      It seems strange that this isn't native to WHMCS already as it aligns with the login process of the normal page?
      Any help with this is greatly appreciated..
    • By wellconnit
      Hi All,
      Does anyone know if it is possible to make a payment through a custom gateway from outside the WHMCS system?
      I want to let users pay with a credit card using my custom payment gateway through my own website rather than the WHMCS website, since the API does not have any function built in for payment of invoices from the remote API I was going to try and reference the payment gateway file directly. Is there a clean way to pass through the variables that the payment gateway is looking for or should I $_POST the variables and then just overwrite whatever the gateway file is looking for so that I don't need to change the gateway code that currently functions?
      Not sure if I will have to manually run the remote API command to AddInvoicePayment to the system depending on whether it is processed or not.
      Thinking about it like that could this be seen as a functional way of completing a payment?
      If someone has a cleaner/simpler solution I'd be happy to hear it?
      Thanks in advance
    • By wellconnit
      Hi All,
      I've been looking for a while to find a solution to how I can display users files in a remote API session.
      Just wondering if anyone has any experience accessing the database across the remote API, I'd rather not write into the page credentials to access the DB, as secure as it may be.
      As the API seems to have a few gaps in functionality, I'm planning on running
      SELECT * FROM `tblclientsfiles` WHERE userid = apiuserid   Which will give me the information I need to display links to each of the files and their titles.   Any help or examples on how to interface with the DB is much appreciated.
  • Recently Browsing   0 members

    No registered users viewing this page.


Important Information

By using this site, you agree to our Terms of Use & Guidelines